~snip~
Sometimes these legislators don't seem to realize that criminals never use KYC exchanges, they will always look for ways to avoid being found. Those who use open services are honest people who have nothing to hide. But having nothing to hide doesn’t mean you need to expose all your data to third parties.
I would disagree with that, because you obviously forgot that there is a huge amount of stolen personal data on the black market, with which precisely those who want to avoid KYC (including criminals) open accounts on CEXs. Of course, this is not something that allows them to use them without problems, because CEXs analyze transactions and can block every account at any time.
and besids using stolen personal data, a lot of them use mules to do that for them, knowingly or unknowingly.
they either pay people a small cut/fee or straight up buy full KYC from less fortunate people who are desperate for a few $$, like addicts or homeless people.
There is almost no exchange that has not been hacked in some form at least once. The fact that we receive information about the amount stolen does not mean that hackers did not reach the database with KYC information. Judging by how vulnerable the security of CEXs is when keeping money, we can only assume that it is even less when it comes to the user's KYC data.